james.maesandClaude Fable 5.2
1915ce2f94
Statements the release reviews of 1.1.1 found untrue at this commit, and two gaps in the release tooling. - Threat model: the version reviewed; an installed build contacts git.kof22.com for updates; the binaries are signed (the accepted risks named them unsigned) and T1 with the Scoop part of T2 is what is accepted; T2 and T11 say what ADR 0009 changed, and T11 is not marked mitigated as a whole while the copy to the release server is manual. - SECURITY.md names 1.1.x as the supported line. - README: the beta is a separate app with its own accounts; parallelism is under Sync options, after loading; the buttons have the names on screen; the app is built unpackaged, with no Developer Mode. CONTRIBUTING the same. docs/CLI.md shows a current version. - RELEASING.md: the check that the server answers from outside comes before anything is tagged; a version that moves the updater is rehearsed with two prereleases read from that server; the copy to git.kof22.com is a numbered step; the packaging change is committed on Gitea; winget is updated by hand while the job would submit the GitHub URL; the engine package is numbered by its own public surface. - Update-PackageManifests.ps1 downloads the file the manifests will name and compares its SHA-256 with that of the built file it is given, instead of asking only whether the URL answers; it writes the Scoop manifest with the repository's line endings. - One vault test stored an entry in the credential namespace the installed app uses. It uses two test scopes now (#161). Closes #183 Co-Authored-By: Claude Fable 5.2 <noreply@anthropic.com> Signed-off-by: James Maes <james@kof22.com>